Multipartite secret key distillation and bound entanglement 
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Recently it has been shown that quantum cryptography beyond pure entanglement distillation 
is possible and a paradigm for the associated protocols has been established. Here we systemati- 
cally generalize the whole paradigm to the multipartite scenario. We provide constructions of new 
classes of multipartite bound entangled states, i.e., those with underlying twisted GHZ structure 
and nonzero distillable cryptographic key. We quantitatively estimate the key from below with help 
of the privacy squeezing technique. 

PACS numbers: 



INTRODUCTION 



Quantum cryptography is one of the most successful 
apphcations of quantum physics in information theory. 
The original pioneering BB84 scheme [l| was based on 
sending nonorthogonal states through an insecure quan- 
tum channel. Then the alternative approach (E91) 
based on generating key from pure entangled quantum 
state have been proposed and later extended to the case 
of mixed states in quantum privacy amplification scheme 
^] which exploited the idea of distillation of pure entan- 
gled quantum states from more copies of noisy entangled 
(mixed) states [Ij. Much later it was realized that actu- 
ally existence of (may be noisy) initial entanglement in 
the state is necessary for any type of protocols distilling 
secret key from quantum states 0, Is] . In a meantime the 
problem of unconditional security (security in the most 
unfriendly scenario when the eavesdropper may apply ar- 
bitrarily correlated measurements on the sent particles 
or, in the entanglement distillation scheme, distribute 
many particles in a single entangled quantum state) was 
further solved in Ref. [7| in terms of entanglement distil- 
lation showing equivalence between the two (BB84 and 
E91) ideas (see Ref. [1] for an alternative proof). How- 
ever, still the protocol worked only for entan glem ent that 
could be distilled. Also, other protocols [9l.Tl0j that ex- 
ploited a modern approach to secrecy (based on classical 
notions) also were used in cases when pure entanglement 
was distillable. It was known, however, for a relatively 
long time that there are states (called bound entangled) 
that can not be distilled to pure form In the above 
context it was quite natural to expect that bound en- 
tangled states cannot lead to private key. However, it 
happens not to be true [l^: one can extend the entan- 
glement distillation idea from distillation of pure states to 
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distillation of private states (in general mixed states that 
contain a private bit) and further show that there are ex- 
amples of bound entangled states from which secure key 
can be distilled. A general paradigm has been systemat- 
ically worked out in Refs. [3, [13] with further examples 
of bound entangled states with secure key [3, \lE\ and 
interesting applications [13, [H, [l3| • From the quantum 
channels perspective the extended scheme [l^] represents 
secure key distillation with help of a quantum channel 
with vanishing quantum capacity (i.e., it is impossible to 
transmit qubit states faithfully). Those channels [l^.[l6| 
were later used in the discovery of the drastically non 
intuitive, fully nonclassical effect of mutual activation of 
zero capacity channels, which "unlock" each other allow- 
ing to transmit quantum information faithfully if encoded 
into entanglement across two channels inputs. On the 
other hand with help of the seminal machinery exploiting 
the notion of almost productness in unconditionally se- 
cure quantum key distillation [2ll | it has been shown that 
unconditional security under channels that do not con- 
vey quantum information is possible 22]. Here we would 
like to stress that we focus on the approach to quantum 
cryptography based on private states rather than the, to 
some extent, complementary information-theoretic ap- 
proach which has also been proven very fruitful (see Refs. 
l[2i|,[2l[23,[23). 

The results discussed above concern bipartite states. 
The aim of the present paper, which, among others, con- 
cludes part of the analysis of [26(] , is to develop the general 
approach to distillation of secure key from multipartite 
states. Basically the content of the paper can be divided 
into two parts. In the first part we systematically and in 
a consistent way generalize the approach from Ref. [l5 ]. 
Here the basic notion of multipartite p-dits that has been 
introduced and analyzed already in the previous paper 

It should be stressed here that, as extensively discussed 
in [l3] , other modifications of the paradigm are possible 
as far as the so-called notion of "direct accessibility of 
cryptographic key" is considered. The p-dit approach is 
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based on local von Neumann measurements, while it is 
possible also to consider local POVM-s Both ap- 

proaches (and additional one) were proved to be equiva- 
lent in terms of the amount of distillable key contained in 
a given bipartite state in Ref. [14]. While we leave this 
issue for further analysis we strongly believe that the ab- 
stract proofs of the latter work naturally extend to our 
multipartite case. 

The first part of the present paper contains qualita- 
tively new elements like conditions for closeness to a p- 
dit state which were not known so far, and a derivation of 
a lower bound for multipartite key where an additional 
analysis of distance to so-called cq states was needed. 
The second part of the paper contains constructions of 
novel states ie. multipartite states that contain secure 
key though are bound entangled. The states are based 
on the underlying (twisted) iV-partite GHZ structure 
and are PPT under any — 1 versus one system par- 
tial transpose. The secret key content is bounded from 
below quantitatively with help of the technique adopted 
form (16i] . 

More specifically after basic definitions and a general- 
ization of the modern definition (that has already become 
standard) of secure key distillation from quantum state 
in Sec. II we pass to Sec. Ill where the notion of mul- 
tipartite private-dit state (in short p-dit) and its prop- 
erties are discussed including especially the condition for 
e— closeness to a p-dit. Distillable cryptographic key in 
terms of p-dits is analyzed in section IV. Here an upper 
bound in terms of relative entropy is proved in analogy 
to the bipartite case. A lower bound on the key based on 
a modification of the one-way Devetak- Winter protocol 
to the multipartite case is provided with help of 
a natural lemma with a somewhat involved proof. Also 
the application [l^ of privacy squeezing [12] is naturally 
extended and applied here. 

The next section is the longest one since it contains 
all the constructions of multipartite bound entanglement 
with cryptographic key. Note that the first construction, 
being an extension and modification of bipartite exam- 
ples from Ref. [l5| , requires nontrivial coincidence of sev- 
eral conditions that are contained in Lemma V.3. They 
ensure that, on the one hand the state is PPT, but on 
the other it allows to be modified by the LOCC recur- 
rence protocol to a state that is close to a multipartite 
p-dit. This is equivalent to distillability. Independently, 
a quantitative analysis is performed illustrating how the 
lower bound for distillable key becomes positive. The 
second class of bound entangled states (to some extent 
inspired by bipartite four-qubit states from [l^) involves 
hermitian unitary block elements of the density matrix. 
Here the construction is different and, in comparison to 
the first one, the observed secure key is much stronger. 
Finally we shortly recall the limitations of quantum cryp- 
tography [H, [IH]- Section VI contains conclusions. 



II. BASIC NOTIONS AND THE STANDARD 
DEFINITION OF SECURE KEY 

In what follows we shall be concerned with the scenario 
in which N parties Ai, . . . , Apf wish to obtain perfectly 
correlated strings of bits (or in general dits) that are com- 
pletely uncorrelated to the eavesdropper Eve by means 
of local operations and public communication (LOPC). 
Let us recall that the difference between the standard lo- 
cal operations and classical communication (LOCC) and 
LOPC lies in the fact that in the latter we need to remem- 
ber that any classical message announced by the involved 
parties may be registered by Eve. Therefore in compar- 
ison to the LOCC paradigm in the LOPC paradigm one 
also includes the map (see e.g. Refs. [ll,[li) 

gAA'BE^'^g''ABE ® l*)(*U' * QAA'BB'EE' 

i 

^Y.(^abe®\^^\a' ® \f)(i\B' ® my, (1) 

i 

From the quantum cryptographic point of view the com- 
mon aim of all the parties Ai, . . . , An is to distill the 
following state 

i=0 

called hereafter ideal c.cq (cq) state, by means of LOPC. 

Here A = Ai . . . An and {\e'f^)}'flQ is some orthonormal 
basis in the Hilbert space corresponding to the jth party 
(denoted hereafter by Hj). Their tensor product consti- 
tutes the product basis in T-Ci (E) ■ ■ ■'E)'Hn, which we shall 
denote as 

Sr' = {kl'^>®---®|e!f)}'~\ . (3) 

(In what follows we will be often assuming {|ep'')}frQ^ to 
be the standard basis in Hj.) One sees that the ideal 
cq states represent perfect classical correlations with re- 
spect to the product basis B^°'^ that uncorrelated to the 
eavesdropper's degrees of freedom. 

We may also define a general cq state to be 

(N.cq) _ I (1) gWl^.S 

ii,...,iiv— 

. 

In the above considerations formula we could take differ- 
ent dimensions on each side, however, for simplicity we 
restrict to the case of equal dimensions. All the parties 
should have strings of the same length at the end of the 
protocol to make a key. 

It should be also emphasized that in what follows the 
jth party is assumed to have an additional 'garbage' 
quantum system defined on some Hilbert space TL'^ . Thus 
we will be assuming that usually the states shared by the 
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parties are defined on the Hilbert space Ti (E)^', where 
H = Hi<».. .<»Hn and n' =n[^.. .^H'j^, 6^™"^ consti- 
tutes the product basis in H. Also, following Ref. p^ . 
the part of a given state corresponding to H [Ti') will 
be sometimes called the key part (the shield part). This 
terminology comes from the fact that the key part is the 
one from which the parties obtain the cryptographic key, 
while the shield part protects secret correlation from the 
eavesdropper. 

Following e.g. Refs. [l^, [l^, using the notion of cq 
states, we may define the distillable cryptographic key in 
the multipartite scenario as follows. 

Definition ILL Let g/\E be a state acting on C''^ (g) 
. . . C*" C^" and (P„)^=i be a sequence of LOPC 
operations such that Pniff'^E) ~ (^ae"^^ where is 
a cq state with A part defined on (C''")'^^. The set of 
operations P = (A„)^j is said to be a cryptographic key 
distillation protocol if 



lim 



„(cq.") 



Sae 



= 0, 



(5) 



This is an important notion since, as shown in the bipar- 
tite case in Ref. (Theorem 1) and as it holds also for 
multipartite states, application of twisting (taken with 
respect to the product basis B^j^°'^) to a given state £Iaa' 
does not have any effect on the cq state obtained upon a 
measurement of the A part of the purification of ^aa' in 
the product basis B^°'^. More precisely states paa' and 
UtQAA'Uf have the same cq state with respect to B^^°'^ 
for any twisting that is constructed using Sj^"^. 

We can now pass to the notion of multipartite private 
states. These are straightforward generalization of pri- 
vate states from Refs. [H, [iSl and were defined already 
in Ref. ;27]. 

Definition ILL. 2. Let Ui be some unitary operations 
for every i and let q/\' be a density matrix acting on TL' . 
By multipartite private state or multipartite pdit we mean 
the following 

rilUiE^eW...ef))(eW...ef)|^C/.,A^C/t. (9) 



where ^'ab'"'' ideal cq state defined on the same 

Hilbert space as ^^ab • We define the rate of the protocol 
P = {Pn)^=i as 



Rp{qae) = lim sup 



log d„ 



and the distillable classical key as 

Cd{QAe) = SUp_Rp(giAE)- 

p 



(7) 



If instead of Qf\E one has the purification \iPae) we write 
Cd{qa)- 

Let us also mention that a good indicator of the se- 
crecy of our correlations as well as the uniformity of the 
probability distribution p^^ is the trace norm distance 

II (id) _ (eg) II 
II ^^AB B/^E 111" 



Naturally, for iV = 2 the above reproduces the bipar- 
tite private states T^'^j^^^A' A' introduced in Ref. [iJ 



It 

follows from the definition that any multipartite private 
state may be written as F^'^, = Ut{P'^^ ® Qa')UI with 
(6) £'A' and Ut denoting some density matrix acting on Ti' 
and some twisting, respectively. Moreover, -Pj^ stands 



for the projector onto the so-called GHZ state ^] given 

by 



i=0 



(10) 



In other words we say that multipartite private states are 
twisted GHZ states tensored with an arbitrary density 
matrix pA'- 

As a simple but illustrative example of a multipartite 
pdit one may consider the following {2D)^ x {2D)^ state 
(with n = (C^)®^ and n' = (C^)^^) 



III. PRIVATE STATES 
A. Definition and properties 

Here we discuss the multipartite generalizations of two 
important concepts of the scheme from Refs. [H, [Tsl j. 
Firstly we introduce the notion of twisting and then the 
notion of multipartite private states. 

Definition III.l. Let (J7ji...i„)ji...i„ be some family of 
unitary operations acting on TL' . Given the A'^-partite 
product basis B^j^°'^ we define multipartite twisting to be 
the unitary operation given by the following formula 



Ut 



d-l 

I'll 

ii,...,iAf— 



(1) 



(8) 



r(2) 



where Vi^^' is a permutation operator defined as 

£1-1 



2D 



N 



2D 



N 







vF^' 



[(|0)(0| 



(8W 



ID 



. 

»N\ ^ y{D) 



(11) 



Fj^' = J2 Kl>(i7r(l)|«)|i2)(i^(2)|«)...(8)|ijv)(z,r(JV)| 

(12) 
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with TT being an arbitrary permutation of iV-element 
set. Clearly vi^'' is unitary matrix for any permuta- 
tion TT and thus |V^^''^''| = Ijjn {\A\ is defined as V A<A). 
This, in view of the Lemma A.l (Appendix), means that 

■A^2(1d"7 ^i^'') > (for the definition of M2 see Ap- 

(2) 

pendix) for any tt and hence Fex represents quantum 
(2) 

state. Moreover, Fex may be derived from the general 
form ([9]) by substituting gA' = ^d"/D^ , i.e., maximally 
mixed state acting on (C^)®^. Finally, both unitary op- 
erations in Eq. ([9]) may be taken to be Uq = V'i^'' and 

As multipartite private state constitute a central no- 
tion of our cryptographic scheme, below we shortly char- 
acterize multipartite private states. Firstly, we notice 
that any state of which cq state is the ideal one with re- 
spect to some basis Bn must be of the form © and vice 
versa. 

Theorem III.l. Let ^paa' be a state defined on 7i (g) W 
with Ti. = (C'')®^ and arbitrary but finite-dimensional 

H'. Let also g'"^^ denote the cq state obtained from the 
purification of Paa' upon the measurement of the A part 
in B^°'^ and tracing out the A' part. Then g^^^ is of the 
form ([2]) if and only if ^aa' is of the form ([9]) , both with 
respect to . 

This fact may be proved in exactly the same way as its 
bipartite version from Ref. [13]. 

Secondly, it was shown in Ref. |27j that any multi- 
partite private state is distillable providing also a lower 
bound on distillable entanglement. For completeness it is 
desirable to briefly recall this result, which can be stated 
as follows. For any multipartite private state F^'^/ its 
distillable entanglement is bounded as 



En T 



id) 



D AA' 



> 



max 

i,j=0,...,d~l 



1 -H 




(13) 



where 



,(1) 



a\-\ and finally a™^'^ are parameters 



characterizing the given private state F^'j^, . They are 
defined as follows 



{h\.--{fN\U^gf,'U]\g{)...\gN) 



(14) 



where maximum is taken over a pair of pure product vec- 
tors 1/1) . . . I/at) and \gi) . . . \gN) belonging to W . The 
parameters o'^^ and a^^'' are given by 



tl f{i3)\ 



N I 



(15) 



and 



^ = (fff^'^l . . . . . . \g^^), (16) 



where |/}'"'^) . . . I/^"*') and \gi'^^) ■ ■ ■ Ig^f^) are the vectors 
realizing the maximum in Eq. . Finally afj'^^ denotes 

the larger of two numbers a-j^ and a-^^ 

It follows from Eqs. ([H]), HH]), and HH) that 77.^ is 

always positive and on the other hand rjij < '^J'a^Kt^ . 
This means that a^^^ > and consequently for any pair 



{i < j) the expression under the maximum in Eq. ([Tc 
is positive proving that Ejj of any multipartite private 
state is nonzero. 

Finally, we notice following Ref. [13] that for bipar- 
tite private states also other entanglement measures were 
bounded from below. Namely, it was shown that 



(17) 



and, due to the fact that entanglement of formation is not 
smaller than the entanglement cost, Epij 
logd. 



(d) 



> 



B. Conditions for closeness to multipartite private 
states 

Here we provide necessary and sufficient conditions al- 
lowing for judging how close to some multipartite private 
state is some given state ^aa' defined onH ^H' . 

Let us firstly notice that any state acting on 7i (g) 7i' 
may be written in the following block form 



E 



d-1 

E 

,jjv = 



qaa' = E E 1*1 ■■ ■ • ■ • I 



■JN 

■iN ' 



(18) 

where i^l^"'f" are assumed to be square matrices de- 
fined on H' ■ Also by gA we denote the state gA = 
TrA'(?7tgiAA'C//) with some twisting Ut, and by igA)il'.'.'.i^ 
its entries in the standard basis. Then we can prove the 
following useful lemma. 

Lemma III.l. Let (3aa' be some density matrix act- 
ing on n<^n' with n = (C')®^ and arbitrary finite- 
dimensional Ti' . Then there exists such twisting Ut 
that for a fixed index i all the elements [gk)l "l and 
(^a)j-;;.j (i — 0, . . . , c? — 1) of the i-th row and column 

of ei'A = TrA'(^7t^^AA'C//) equal and | mv;.^- 1 1 ^ , 

respectively. 

Proof. The proof is a simple extension of the one pre- 
sented in Ref. p'j. Acting on the state ^aa' with an 
unitary twisting Ut and tracing out the A' subsystem, 
one gets 



d-l d-l 



E E Tr(t/... 



. riii---JNTj\ 



ii,...,ijv=0 ji,... j"jv=0 



x\ii...iN){jl...jN\- (19) 



First of all let us mention that from Eq. it follows 
that we do not need to care about blocks lying on the 
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diagonal of ^aa' as the blocks ft] 
and the following holds 



..iiv 



must be positive with d = 2. Then from Eq. ([18)) it can be written as 



Tr 



Qii...jjvrrT 



Qll...liV 

I 111' 



(20) 



Now, let us focus now on the matrices i^^' f for some 
fixed i and any j ^ i (as the case of i = j has just 
been discussed). For simplicity and without any loss of 
generality we can choose i = and thus we need to prove 
the theorem for j = 1 , . . . , d — 1 . At the beginning let us 
concentrate on the matrix ^q"'q. We can express it with 
the singular-value decomposition as = ViDiWl, 

where Vi and Wi are unitary matrices and Di stands 
for a diagonal matrix containing singular values of rij ' g, 
i.e., eigenvalues of |ilQ - J|. Then from Eq. (fT9|) one infers 

that it suffices to take J7o...o = and J7i...i = in the 
twisting Ut to get 



Tr (Uo...o^o,:.lul = Tt{V''VDW^W) 



-TtD 



I 0...0II1 ■ 



(21) 



Now we may proceed with the remaining matrices ^q"q 
{j = 2, . . . ,d — 1). We need to find such matrices in the 
twisting Ut that Eq. (|2ip holds also for the remaining 
rig ' g. Notice that unitary matrices C/0...0 and C/1...1 have 
just been fixed, however, we have still some freedom pro- 
vided by Uj,,,j (j = 2, . . . , d—1). Using the singular value 
decomposition of all ^q"q (j — 2, . . . , d—1) we may write 



= VjDjW^. This leads to 



Tr 



(^t^0...of^g.'.'.g 



U. 



:Tr 



■o...o'^i...j 



(22) 



where we used the property of trace saying that Tr^i? = 
TrBA. It is clear from the above that to get the trace 
norm of f^g " g for any j = 2, . . . , d — 1 it suffices to choose 
Uj j in such way that W}U^ o^/V^i = 1- This means 

J J J J •••J ^ 

that Uj,,.j = V^VjW] {j = 2,...,d-l). The remaining 
Ui-^...it^ appearing in the definition of Ut may be chosen 
at will. Concluding we showed that there exists such 
Ut that for a fixed i it holds that {'gpCjl'l = 

(j = 0, . . . , d - 1). The fact that also {Qk))::'j = jjf^i'.'i ||i 
follows obviously from hermiticity of ^a- | 

This is a very useful lemma due to the fact that twist- 
ings do not change the cq state. It allows us to concen- 
trate on a particular form of a given state ^aa' ■ In other 
words, we can think about the state gAA' as if it has such 
a reduction to A subsystem that some of its elements in 
fixed row or column are trace norms of respective blocks 
of paa' (obviously with respect to the same product basis 



Paa' 



Q0...0 
"0...0 

r,o...o 
"0...1 



Q0...1 
"0...0 

"0...1 



r,l...l 
"0...0 

r,l...l 
"0...1 



(23) 



where 



(f}}-:X)^ and > O for any 

*fej Jfe = 0, 1. In view of Lemma 3.2 the above may be 
brought to the following state 



£lA = TrA'(C/teAA'C//) 

l^o:::o||i (6'A)g:::g 



0...0 
1 



IqO.. 



1 

llll 



|r)l...l|| 
|"0...0||i 

^Q^)l::\ 



I 111 



(24) 



Now we are prepared to provide the aforementioned 
conditions for closeness to multipartite private states (the 
bipartite case was discussed in Ref. [Ill)- Firstly we show 
that if a given £1aa' is close to some multipartite pdit then 
(due to the above lemma) there exist such Ut that the 
A subsystem has all the elements {Ti/\'UtgAA'U}){"'l = 
ll^l'.'i II 1 for j = 0, . . . , d - 1 close to 1/d. 

Theorem III. 2. Let ri^^ 'f" be some matrices and 
qaa' be an A^-partite state of the form pS]) such that 
||paa' — TaIx'IIi — ^ ^'-'^ some multipartite private state 
t'^^, for some e > 0. Then for a fixed index i one has 



(1/d) < e and 17 



111 



(l/c') < e for any 



ll|f^i:illi- 
j = 0, . . . , d - 1 

Proof. The proof is a modification of the one given 
in Ref. [1 



(Proposition 3). Let F^'^/ be such a private 



state that paa' 



that F 



id) 



^AA'lli — ^ ^^'^ ^* such twisting 
aa' ~ ^tiPdN ® ^f^'Wt with (Ta' denoting some 
state on Ti' . Then, due to the invariance of the trace 
norm under unitary operations, we have 



UlQAA'Ut- P''/^®aA, 



< e. 



(25) 



Now, utilizing the fact that the trace norm can only de- 
crease under the partial trace, we get 



9A 



d(+) 



(26) 



prod>^ 
N 



where qa is of the form p^ . Notice that in general Ut 
does not have to be the one bringing q/\ to the form dis- 
cussed in Lemma III.l. After application of the explicit 
As an illustrative example we can consider paa' form of and ^a given by Eq. (fTO|) . one can rewrite 



6 



the above as 



rf-i 

iij-.-.-i^v— 

jl,...,jN^O 



■JN 



It follows from the Cauchy-Schwarz inequality that the 
absolute value on the right-hand side is not greater that 
one. Thus we get the inequalities 



d-l 



1 

1 a 



1. 



(33) 

Joining this facts 



< e. 



(27) 



Now we may utilize the fact that for any A — a^- \i) {j \ 
square of its Hilbert-Schmidt norm is given by ||^||2 = 



E 



and that P||2 < \\A\\i. Therefore, if ||A||2 < e TrgA 



for some e > then one infers that any of its elements 
obeys \aij\ < e — 0, — 1). This reasoning, 

after application to the matrix — PdN ' l^ads us to the 
conclusion that for any i, j = 0, . . . , c? ~ 1 it holds 



Tr U,._ 



< e, 



(28) 



which eventually gives |Tr(C/,...,f][j'C/j ^-)| > l/d - 
e. This, after application of the polar decomposition 
of and properties of trace can be rewritten as 

|Tr(Wy |f7[;f|)| > l/d - € with W.,j being some unitary 
matrix. Now, applying the Cauchy-Schwarz inequality 
to the Hilbert-Schmidt scalar product we can infer that 
for any positive A and unitary W the following chain of 
inequalities holds 



|Tr(W^A)| = 



Tr ( Wy/A\/A 



< ^Tr (wVAVAW'''^\/TrVAVA 

= TrA = Pill. (29) 

Thus we have that ||r2f"/||i > l/d — e for any = 
0,...,d-l). 

On the other hand we can apply such twisting Ut that 
after application to £Iaa' and tracing out the A' subsystem 
we get Pa such that in its ith row (or column) {])f\)l"'l ~ 
for i = 1, . . . . d— 1. Then, one easily concludes 

that 



Q^^' 



< e 



(30) 



with paa' = UtQ/Kf^'U} . After the analogous reasoning as 
in the previous case we get 



-iTr(W,,aAO 
id 



< e 



(31) 



for some chosen i and j = 0, . . . ,d ~ 1. Here by Wij we 
denoted all product of the respective unitary matrices 
following from product of Ut and Ut- Using the fact that 
l-^i — Z2I > l^il — 1^21, we infer from the above inequality 
that 



I. ..I 



1 

1 d 



(32) 



for the chosen i and j = 0, . . . , d - 
together we get the desired result. | 

Notice that in the particular case of d = 2, discussed 
already in Ref. [11] (Proposition 3), the only condi- 
^ (and equivalently for ||il!j'- -5||^) is that 

^ > 1/2 — e. This is because, due to the fact that 
1 and the positivity of pa > (and thus also of 



tion for ||riJ;;;J| 

"0...0 



the 2x2 matrix containing the elements ||r^:^' f || with 

t,j = 0A)pt:l\l<i/2. 

Interestingly, one may prove also a converse statement, 
namely if after applying respective twisting Ut, for some 
fixed row, say the ith one, all "i||i are close to l/d, 
then there exists some multipartite private state close to 
a given state paa' ■ 

Theorem III. 3. Let paa' given by Eq. (flSj) be such that 
for a fixed i the blocks i^f'f obey "f||i — l/d| < e 
for any j = 0, . . . ,d — 1 and < e < l/d. Then there 
exists such a multipartite private state rlj?, that 



.(d) 

AA' 



< 



log2 ]^2N^dr]{e) \ogd + H{2^/dr]{e)) 
-2./Me), (34) 



where 77(e) ^ if e — > and consequently the function 
on the right-hand side tends to zero whenever e — > 0. 
Here H denotes the binary entropy. 

Proof. The proof is based on the one given in Ref. 
[Tst . Let Ut be such twisting that for fixed i it holds 
of (^A)i;i = ll^^lVilli (j = 0,...,d-l). Then since 

(s'a)!'.'./ — [(£'a)5v;.j]* with asterisk denoting complex 
conjugation, the Hilbert-Schmidt scalar product of ^a 
and P^^li may be expressed as 

^^^:i^ = ^E(^)i:i 

i.3=0 
d-l 



-J d—1 ^ d—1 



(35) 



i=0 



On the other hand from the positivity of g/\ one may 
prove the following inequality 



d~l 

E 

i=0 



> 



d~l 



Re(giA) 



J---3 



(36) 



which after substitution to Eq. (|35p gives 



Ti-PaP^ 



(+) 



N 



> 



d-l 



d-l ^ 

i<3 



Re(eA)l-; 



3---3 



(37) 



7 



Now we can utilize Lemma A. 2 (see Appendix) to the 



d X d matrix with entries (f?A)i 



[1,3 



0,. 



1) 



Namely, due to the assumption that for some fixed i the 
elements ('qk)1"'1 satisfy \ij>h)l"'l — < e, we have 
from Lemma A. 2 that \{'Q^)l"'l — l/d\ < ri{e) for any 
i, j = 0, . . . , d — 1 with r/(e) — s- for e — s- 0. This means 
that the real parts of any (pa)!'. '/ also satisfies the above 
condition. In this light we get from Eq. ([57|) that 

d-l 



i<j 



2 1) /I 

d- 1 2 Vd 
1 - d7,(e), 



(38) 



where the first equality follows from the fact that the re- 
spective sum contains d{d — l)/2 elements. The remain- 
der of the proof goes along the same line as its bipartite 
version from Ref. [l3| leading to the claimed inequality. 



Notice that to prove the theorem for the particular case 
of d = 2 it suffices to assume that ||i7Q - Q||j^ > 1/2 — e. 

Concluding we obtained necessary and sufficient con- 
ditions for a given state pa^/ to be close to some multi- 
partite private state expressed in terms of the trace norm 
of some blocks of ^aa' (see Eq. (IISI) ). 



IV. DISTILLABLE CRYPTOGRAPHIC KEY 

A. Definition 

Having introduced the concept of multipartite private 
states we may pass to the definition of multipartite cryp- 
tographic key. The seminal fact behind the notion of mul- 
tipartite private states is that as shown in Refs. [l^, [l3| , 
one can think about quantum cryptography as a distilla- 
tion of private states by means of LOCC. In other words, 
we have a standard distillation scheme (as entanglement 
distillation) in which we can forget about the eavesdrop- 
per. 

Definition IV. 1. Let g/i, denote a given multipartite 
state acting on (g) . . . (g) C''" and (A„)^]^ a sequence 
of LOCC operations giving A„(p^") = g"^^, with g^^^, be- 
ing a state acting on (C*")*^^ (^H^- Here H'^ stands for 
a finite-dimensional Hilbert space corresponding to the 
A' part of Paa" Then we say that A — (A„)^j^ is a mul- 
tipartite private state distillation protocol if there exists 
such a family of multipartite private states {t''^^/')^^^ 
that the condition 



lim 



(n) _ -p(rf,.) 
fe^AA' ^ AA' 



= 



(39) 



holds. A rate of the protocol A is defined as i?A(pA) = 
limsup„_^o^[(l/n) logc?„] and the distillable key as 

KoigA) ^supRAigA)- (40) 

A 

As shown in the bipartite case in Ref. both the 

Definition II. 1 and Definition IV. 1 are equivalent in the 
sense that if there exists LOCC protocol distilling some 
multipartite private state there also exists LOPC pro- 
tocol distilling the ideal ccq state (when purification is 
considered) with the same rate. As the proof from Ref. 
[ist may also be applied to the multipartite case, we pro- 
vide the generalized version of the above fact below. 

Theorem IV. 1. The following two implications hold. 
Assume that from a given state a a such that Eve has its 
purification \tPae) one may create by LOPC some cq state 



Q^AE (see Eq. 



(HI) obeying 



\S'ae 



(id) I 

Qae] 



< e for some 



e > (recall that g'"^ denotes the ideal cq state given by 
Eq. Then there exists such LOCC protocol that can 

distill a state ^aa' from a a that satisfies ||paa' ~r 

2-y/e for some multipartite private state T^f' 



(d) 



< 



- AA'IIi 

. . On the 

other hand if from (Ta one can distill a state Paa' close to 
some pdit i-e., such that ||giAA' — < e then 

there exists a LOPC protocol distilling from gA a cq state 
such that \\g^^E ^ (^AE 111 — 2v^- Each subsystem of the 
A part of g'"^'^ and of the key part of rj(^, is defined on 
C^. 

Proof. The proof goes directly along the same lines as 
the one from Ref. |13| . 

Interestingly, the distillable key Kd may be used to 
quantify entanglement among multipartite states. More 
precisely, from the definition it follows that Ko is mono- 
tonic under the action of LOCC operations (see e.g. [22] )■ 
Moreover, it vanishes on multipartite states that have 
at least one separable cut, which is a consequence of 
the straightforward multipartite generalization of the re- 
sults from Ref. fE, ^ provided in Ref. ^3^ . Finally, as 
we shall show the distillable key is normalized on GHZ 



states -Pj^ in the sense that KoiPyj^) = logd. How- 
ever, firstly we need to provide two bounds on Ko- 



B. Bounds on tlie distillable key 

The first bound is a simple multipartite generalization 
of the upper bound provided in Ref. [T3 |. while the sec- 
ond bound is a consequence of a multipartite adaptation 
of the Devetak- Winter protocol [1, [l3| ■ Let us start from 
the upper bound. 

Theorem IV. 2. Let gA be some A^-partite state. Then 



Kd{qa) < E^{gA), 



(41) 



where E^(gA) is a regularized version of the relative en- 
tropy, i.e., 

E^igA)^ lim - mf Sigf-\\gl^n (42) 

n-*oo n g'f^ev 
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and V denotes the set of all A''-partite fully separable 
states, i.e., states of the form 



sen \^ (i) 
= l^Pil^A, 



(43) 



Proof. The proof is a generalization of the one from 
Ref. [13]. 

Interestingly, we may also bound K]j from below. For 
this purpose we need to prove the following theorem. 

Theorem IV. 3. Let q'^'^ be some multipartite cq state 
acting on (C"*)®^ ® C*^ and given by 



(cq) 
0AE 



d-1 

E 



Pn. 



.in\ 



(44) 



for any pair of indices fc, Z = l,...,iV. To end 
the first part of the proof it suffices to substitute 

Y.i\{k,i}Pii-^NQn...ir, = <lil^,.Qf,...^,,. whcrc Summation 
over / \ {k,l} means that we sum over all ij but ik and 
k- 

To proceed with the second part of the proof we assume 
that one chosen party, say Ai , shares with the remaining 

— 1 parties a state that is close to the bipartite ideal cq 
state. In other words we assume that for any j — 2, . . . , N 
the following inequalities 



E 



Ph...z«\mj){iiij\ 



si 



(2, id) 



2l,...,2iV— 



< e 



(49) 



Then it is arbitrarily close to the ideal cq state if and 
only if for a chosen party Ai all the reductions to three- 
partite systems AiAjE with j ^ i are arbitrarily close to 

the bipartite ideal ccq state. More precisely, if Upab'' ~ 

£'a£;'"*^|| — ^ holds for e > 0, then for the fixed party A.^ 
the following inequalities 



d-l 

E 

ii ,...,'i7V— 



(2,id) 



< e 



(45) 



are satisfied ior j — 1, . . . ,i — l,i + 1, . . . , N 
assuming that for fixed Ai the inequalities 
e > and j ^ i, one has 



(JV,id) 

8ae 



< (4iV- 3)e 



Conversely, 
hold for 



(46) 



Proof. We proceed in two steps. In the first step we 
show that if the trace norm distance between some mul- 
tipartite cq state g''^^ and the ideal one is bounded by 
some e > then any bipartite state arising by tracing out 
N — 2 parties from the cq state is close to the bipartite 
ideal ccq state. This part of the proof is relatively easy 
since it suffices to utilize the fact that the trace norm 
distance does not increase under the partial trace. The 
proof of the converse statement is much more sophisti- 
cated. 

Let us assume that the following 



9^A^ 



(TV, id) 

Sae 



< e 



(47) 



holds for some small e > 0. Then since the trace norm 
does not increase under the partial trace we have imme- 
diately the following set of inequalities 



il,...,'iiV— 



< e 



(48) 



are satisfied. Basing on this set of inequalities we will 
show that the left-hand side of Eq. ([T7|) is bounded from 
above by some linear function of e vanishing for e ^ 0. 
For this purpose let us denote the left-hand side of Eq. 
P7)l by LHS and notice that it can be split into two 
sums (see Eqs. ^ and (U)), namely the one containing 
the elements for ii = ... — in and the rest ones. In 
this light, denoting by / the set of sequences (ii, . . . , i^v) 
obtained by removing all those with ii = ... = in from 
the set of all possible sequences, we can write 



d-l 



LHS = ^ P^^...^M +E 

(ii,...,iiv)e/ ^=0 

d-l 

(ii ,...,ijv)6/ 
d-l 



E 1 B 

Pi...tQi...z - -^9 



■I... I 



i=0 



E 

i=0 



1 



Pi. 



(50) 



where the inequality comes from the fact that the term 
Pi...iQf i was added and subtracted in the second term 
in the first line and from the inequality ||A + _B||i < 
ll^lli + \\B\\i- The last equality is a simple consequence 
of the fact that the trace norm of any density matrix 
is just one. In what follows, using the inequalities (I49p . 
we show that all the three terms appearing in the above 
are bounded by linear functions of e vanishing for e — s- 0. 
With this aim, utilizing once more the fact that the trace 
norm does not increase under the partial trace, we can 
infer from Eq. (gn]) that 



d-l ^ d-l 

Y fti-*ivNi«j)(«i«jl - ;7E 



■ii,...,ijv— 



2^0 



<e (51) 



for j = 2, . . . , N . Now we can divide all the terms appear- 
ing in the first sum into two groups, namely, the one for 
ii — ij and the remaining terms. This, after calculating 
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the respective norms, leads to the following inequality 



E 

i=0 



E 

-1 



i2,...,ij-i,ij+i,...,iN=0 
d-1 



(52) 



Obviously, since both terms in the above are nonnegative, 
any of them must be less or equal to e. This allows us to 
write the inequalities 



d-1 

E 




d-1 

E 








and 







1 



< e (53) 



the remaining ones is different from ii. One sees that the 
second term on the right-hand side of Eq. (|56p may be 
bounded from above in the following way 

i-i d-1 

{ii,....iN)eij fc=2ii,...,j„=o 

+ E E p^i-i" 

fc— j + 1 ^l,...,^^v— 

i-1 W 

^E^+ E ^ 

fe=2 fc=j + l 

= (TV -2)6, (57) 
where the second inequality is a consequence of the in- 
equality given in Eq. ()54p . Finally, application of Eq. 
(|Ff| to Eq. jSSl), gives 



d-1 



E Pn■■■^N < e- 



(54) 



ii,...,iN—0 



E 

i=0 



< (^- l)e. 



(58) 



From the sum appearing under the sign of an absolute 
value in ()53p we can extract the probability pi...,;, obtain- 
ing 



d-1 

E 

i=0 



1 



d-1 

E 



Pit2...lj-lltj+l...lN 

i2,---ij~i,ij + i,.-.,ijv=0 
{i2,---ij-l,ij+l,---,iN)eIi 



< e, 



(55) 

where Ti denotes the strings of — 2 indices 
(i2, . . . , ij-i, ij+i, ■ ■ ■ t^n) such that at least one of them 
is different from i. Utilizing a simple inequality |zi — 22! > 
\zi \ — \z2\ satisfied by all zi, Z2 £ C, we get 



This is a quite natural conclusion saying that if the mea- 
surement outcomes between fixed party (here ^1) and 
each of the remaining ones are almost perfectly correlated 
then the measurement outcomes are almost perfectly cor- 
related among all the parties. 

We have still two terms in Eq. ([50]) unbounded. Using 
once again the inequality \zi — Z2\ > |zi| — |z2| {zi, Z2 G 
C) and the fact that Pi^,,AN represents some probability 
distribution we may write 



E 

1=0 



1 



Pi.. A 



d-1 



<^+E E p^^-^.-.^...-^^ 

i=0 (i2:---,ij-i,ij + i,---,iN)e2:i 

= e+ ^ (56) 

(ii,...,ijv)elj 



^ ^ Pil...iN 
(ii,...,ijv)e-f 



d-1 
1 - YPi...i 

< 1 - [1 - (iV - l)e] 

= (^-l)e. (59) 



where X, denotes the string of N indices such that the 
first and jih. ones are equal {ii ~ ij) and at least one of 



Thus, the only thing we need is to bound from above the 
last term in Eq. 150]) . Remarkably, to achieve this aim it 
suffices to utilize a single inequality from the whole set 
say the one for j = 2. The we can write 



10 



rf-1 



d-1 



ii,...,iiv— 



d-1 d-1 

"^Pi,„,\ii){ii\ (g> gf ^ --lYl 1")*^" 



i=0 



i=0 



(ii,...,ijv)eX2 



il ,...,iAr— 



1 

(60) 



Then, due to the fact that \\A — > ||^||i — ll^lli, we may rewrite the above as 



d-l 



^ d-l 

i=0 i=0 



d-1 



1 (ii,...,iN)GX2 

< e + (iV - 2)e + e = A^e 



(61) 



where the second inequahty follows from Eqs. ([5^ and ([57)1 (with j = 2). On the other hand, we can easily show 
that 



d-1 ^ d-1 



i=0 



1 i=0 



i=0 



1 



Comparison of Eqs. ([5T|) and allows us to write 

d-1 



d-1 



Pi... J 



(62) 



E^'--ll^?---^^''lli^^^+E 

<iVe+ (iV- l)e 
= (2iV- l)e. 

Putting now all the pieces together, that is, substituting Eqs. ([55)) . ([55)) . and to Eq. ([50]) . we finally have 



d-1 ^ d-1 

E Pn...*iv 1*1 ■• • iN){ii . . . zatI (g - ;^ E 

ii,...,Ziv— 



1=0 



< (47V - 3)e. 



(63) 



(64) 



Noting that for fixed it holds that {AN - 3)e 
whenever e ^ we finish the proof. | 

It should be mentioned that as it follows from the sec- 
ond part of the proof, we do not need to assume the whole 
set of inequalities given in (|49)) . Actually it suffices to as- 
sume that a single inequality from the set holds and 
the remaining ones from the set given in Eq. (I5ip . In 
other words it suffices to assume that the measurement 
outcomes between a fixed party and any from the other 
parties are almost perfectly correlated and that Eve is 
almost completely uncorrelated from the measurement 
outcomes of a single pair. This is in full agreement with 
our intuition. Namely, if the measurement outcomes of 
any pair AiAj (with fixed i and arbitrary j ^ i) are per- 
fectly correlated and Eve has a full knowledge about the 
measurement outcomes of just a single party, she actu- 



ally has the knowledge about measurement outcomes of 
all parties. Therefore if all the parties have perfect corre- 
lations and Eve is completely uncorrelated from a single 
party, she must be completely uncorrelated from all the 
parties. Consequently, it is sufficient to assume that a 
single pair shares state that is close to a ccq state and 
other chosen pairs have almost perfect correlations. 

Now we are prepared to provide a lower bound on the 
multipartite distillable key in the LOPC paradigm. We 
achieve this by extending of the Devctak- Winter protocol 
to the multipartite case. We do this by applying the bi- 
partite Devetak- Winter protocol to — 1 pairs of parties 
in some state g^E such that each of them consist of one 
chosen party, say Ai, and one of the remaining ones. Ev- 
erything works as in the standard Devetak- Winter proto- 
col, i.e., the party Ai performs the measurement in some 



11 



basis, e.g. the standard one obtaining the so-called cq 
state (classical-quantum-. . .-quantum) 



Pi|«)(«Ui ® 



6Ai...AnE- 



(65) 



Then, roughly speaking, the party A\ performs the 
Devetak- Winter protocol with the remaining parties si- 
multaneously. One knows that the correlation between 
A\ and the remaining parties Aj (j = 2, . . . , ISS^ are de- 
scribed by the mutual information 1{A\ : Aj){Q^'^^,^. 
However, the establish common multipartite key we 
need to consider the worst case, i.e., minj=2,...,Af ^(^i '■ 
^i)^Q'MA e)- "^^^ other hand, the correlation be- 

tween A\ and E are given by /(Ai : E) and this amount 
of bits has to be substracted at the privacy amplification 
stage of the process. 

Consequently, the rate of the protocol is 



. '?in^/(Ai:A,)(f.(i7l'^.^)-/(Ai:i?)(^,^^™ ) (66) 
and therefore, the multipartite distillable key satisfies 



cqq) 



the above bound. We know from Theorem IV. 1 that 
Kd{pIiIn) = CD{\i^^Ms))^ where IV'I'e') is a purification 
of -P^^ and obviously has the form |V'^~^)a|-E) with \E) 
being some state kept by Eve. Measurement of the A 
subsystem of IV' as) '^ith respect to the standard basis 
leads us to the ideal cq state g"^'^ = uj^'^^ (8) \E){E\, 
where 



i=0 



d-1 



(70) 



which has the quantities I{Ai : Aj) = logd — 
1,...,N) and I{Ai : £;) = (i 1, . . . , TV). Substituting 

both these facts into Eq. gives us Kjj^P^'^j^) > log d. 

On the other hand we can utilize the bound given in 
Eq. gl]). Firstly, notice that S'(/o®"||(t®") = nS{p\\a) for 
two an arbitrary natural number n and arbitrary density 
matrices p and a. Secondly, one easily finds that (see e.g. 
Ref. nil) 



N\ 



(d,N)^ 



logd 



(71) 



Cnig;,E)>^mm^IiA^:A,)ig^2^tE)-Ii^^--E)i^^^^^^ 

(67) 

Here, g^^'^'^.^ denotes the cqq state, which arises from 
([^5)1 by tracing out all the parties but the first and jth 
one and Eve. Moreover, by I{X : Y){gxY) we denoted 
the mutual information defined as I{X : Y){gxY) — 
S{gx) + S{gY) — S{gxY) with S denoting the von Neu- 
mann entropy. 

We have still some freedom in choosing the distributing 
party and therefore we can always choose the one for 
which the rate of the extended Devetak- Winter protocol 
is highest. In this way we get the lower bound on Cd of 
the form 



^(cqq) 



Cd{qae) > max 

i=l,...,N 



. rnin I{A:A,){g'^^l]^) I{A:E)ig^^l> ) 

j — l,...,N ^ ^ ^ ^ 

(68) 

Let us finally mention that due to the Theorem IV. 1 
we can also bound Kd from below using ([68)1 . Namely, 
since K£i{g^) — CD{\^^^E)), we have the following 



^(cqq) 



max 

= 1,...,JV 



min I(Ai:Ai) 

= 1,...,N 



HA:E) 



(69) 

where the respective quantities are calculated from e.g., 
the cq state following the purification of g^. 

Now we can go back to the definition of Ko. As 

previously mentioned, it holds that X£)(pj^) = logd. 
To show it explicitly, on the one hand we can utilize 



and consequently the following estimate holds 

Kn (Pi+^ ) = hm^ i jnf ^ 5(p(+^«" 1 1 g^^ 



- lim -r>S(P^+M\J'^'^'>) 



= log d. 



(72) 



Thus Kd{pI^^j^) < logd and taking into account the pre- 
viously obtained inequality Kj:){p'^^) < \ogd we infer 

Kd{P^'^j^) ~ logd. Thus, as stated previously, the mul- 
tipartite distillable key may be considered as a entangle- 
ment measure. 

Let us discuss the last issue of this section. To ap- 
ply the extended Devetak- Winter protocol successfully, 
that is to get a nonzero rate, one obviously has to have 
the right-hand side of Eq. ((68)) positive. One knows 
from Theorem IV. 1 that distillation of some multipartite 
private state by means of LOCC is equivalent to the dis- 
tillation of an ideal cq state by means of LOPC. This 
in turn means that the closer some particular state paa' 
is to some multipartite private state, the closer is a cq 
state obtained from it to the ideal cq state. Then, from 
Theorem IV. 3 it follows that the closer some cq state is 
to the ideal cq state the closer are its bipartite reduc- 
tions to the bipartite ideal ccq state. Both these facts 
mean that by distilling some multipartite private state 
from copies of a given state we can make the right-hand 
side of Eq. ((68)) (equivalently Eq. ((69)) ) positive. Con- 
sequently, concatenating some LOCC protocol distilling 
multipartite private states (an example of such a proto- 
col is given in the following subsection) and the extended 
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Devetak-Winter protocol introduces a subtle effect here. 
Namely, on the one hand, using more copies in the LOCC 
protocol producing a state that is closer to some multi- 
partite private state makes the right-hand side of Eq. 
([68)1 larger. On the other hand spending more copies 
decreases the success probability which needs to be in- 
cluded in the overall rate of the protocol. This issue will 
become more clear when some particular classes of states 
will be investigated in the next section. 



C. Recursive LOCC protocol distilling multipartite 
private states 

Here we provide an illustrative example of a recursive 
LOCC protocol allowing for distillation of multipartite 
private states from some classes of states. This protocol 
is a generalization of the LOCC protocol discussed in 
Ref. [13|] to the case of an arbitrary number of parties. 
Assume then that N parties Ai, . . . , An have k copies 
of some state p^A' in their possession. In ith step each 
party performs the following operations. 

• Take the state p^^f^/^^ (where p^"^, = Paa') ^md one 
of the remaining k — i copies of pAA' • 

• Treating A part of p^A'^'' (paa') as source (target) 
qubits, perform CNOT operations. 

• Finally, the parties perform the measurement in 
computational basis on the target qubits and com- 
pare the results: in the case of equal results (all 
zeros or all ones) the parties keep the state, other- 
wise they get rid of it. 

In this way, spending k copies of some state paa' , a-U 
the parties can distill a state g^^^, that is closer to some 
multipartite private state than the initial one, i.e., paa'- 
Quantitative analysis concerning this protocol after ap- 
plication to two different constructions of states may be 
found in Sections [V AI and IV Bl 



D. Multipartite privacy squeezing 

Concluding the discussion concerning the distillable 
key we need to mention the multipartite version of the 
so-called privacy squeezing [l^ [l^ together with its ap- 
plication in the recent important method of bound- 
ing the secret key from below. Following Lemma III.l 
we know that having some state ^aa' expressed in the 
form , there always exists a twisting Ut that the state 
^A = TrA'([/t£'AA'C^/) has some special form. Namely, in 
some chosen row (column) some of its entries are trace 
norms of respective blocks of £Iaa' ■ We will call the state 
Pa obtained in this way privacy squeezed state. Further- 
more, we already know that twistings do not change the 
cq state with respect to some basis B^°'^. 



Let us now proceed by stating some of the conclusion 
following both the above facts. As previously mentioned 
we have that Kiy{g/:^) = CdHiPae)), where \iPae) de- 
notes the purification of qa- Assuming that all the par- 
ties share some state £Iaa' defined onTL^Ti' and denoting 
by |'0aa'_b) the purification of qaa'^ we have 

Kd{QAA') = CD{\i^AA'E)) > C'DiQAE) > Coig''^^^). 

(73) 

Here qae = Tta'\'iPaa'e){'<Paa'e\ and g'^^^^ stands for a cq 
state obtained upon the measurement of the A subsystem 
in B^°'^. The first inequality follows from the fact that 
throwing out the A' subsystem one can only lower the key 
as it could be treated 'virtually' as giving it to Eve. The 
second inequality is a consequence of the fact that mea- 
surement in some product basis leads to classical state 
on the A part of the state (notice that such measurement 
is LOPC operation which due to the definition of Cd can 
only lower its value). 

Now we can formulate and prove the following theorem 
as a multipartite generalization of the bipartite consid- 
erations from Ref. fl^ (cf. [l3]) which exploit privacy 
squeezing to bound the secure key from below. 

Theorem IV. 4- Let (Jaa' be some A^-partite state de- 
fined on H(8)H'. Then 

KD{gAA')>CD{^^t), (74) 

where g^^^'' is a cq state derived from purification \gAE) 
of privacy squeezed state gA = TvA'iUtgAA'U}). 

Proof. Denoting by |i/'aa'_e) the purification of paas 
we have immediately from Eq. (1751) that Kn{gAA') > 
Cd(£'ae ) with g''^^ standing for a cq state being a re- 
sult of the measurement of A part in B^°'^ and tracing A' 
part of IV'aa'b)- Then, as already stated, for any twisting 
Ut (in 3'^°'^) the states (Jaa' and paa' = UtgAA'U] have 
the same cq states with respect to the basis B^°'^. Con- 
sequently, Coio^fi^E) = C'£'('^AE^) '^ith (T^^'j^ being a cq 
state derived from the twisted state UtgAA'U} (obviously 
via its purification). Now, we can consider the situation 
in which the A' subsystem is given to Eve. This means 
that instead of taking 'huge' purification \'(Paa'e) of the 
privacy squeezed state pA = TrA'PAA' = ^i^A'iUtgAA'Uj) 
we can take a 'smaller' version denoted by I^ae) (more 
precisely to purify some density matrix acting on Ti. it 
suffices to use a Hilbert space of lower dimensionality 
than to purify a state acting on H (g) H'). The new pu- 
rification obviously must obey gA — TTE\gAE){QAE\- Now 
comparing these two situations we infer that 0^(0'^^^) — 
Coilf^E) holds, where 'g"^'^ is cq state appearing upon 
measurement of A subsystem of Ipab) in B'^°'^. The in- 
equality is a consequence of the fact that in the case of 
the first cq state the A' part unused, however, kept by the 
parties. In turn, in the second situation the A' subsystem 
is treated as it would be given to Eve when deriving g^^^ . 
Giving some part of state can only lower the secrecy as in 
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this case, roughly speaking, she gains some information 
about what is shared by the parties. This concludes the 
proof. I 



V. CONSTRUCTIONS 

In this section we present two constructions of multi- 
partite bound entangled states with nonzero distillable 
cryptographic key. Both are based on the structure ex- 
hibited by the GHZ states and therefore the scheme of 
secure key distillation presented above easily applies here. 

The first construction is a straightforward generaliza- 
tion of the bipartite construction presented in Ref. p^ . 
Therefore, for comparative purposes, we present also a 
plot containing a lower bound on distillable key in the 
bipartite case. The second construction is completely 
new and in comparison to the first one allows to get a 
higher lower bounds on distillable key than the first one. 

Before we start it is desirable to establish the notation 
that we will use extensively below. By Vq^^ we shall de- 
note a projector onto the A^-partite pure state I'^q^') = 
|0)®^ and V^^^ (i = 1, . . . , iV) is a projector onto the 

iV-partite state IV'i^'): in which the ith party possesses 
|1), while other particles are in the |0) state. For in- 
stance 7'2^'' denotes the projector onto the four-partite 



pure state \ip^^) 



10100). Moreover, let P^^^ and pf^ 



denote projectors obtained from Pq^^ and Pi^\ respec- 
tively, by exchanging all zeros and ones. Thus, for ex- 

(4) (4) 

ample P2 is the projector onto ji/jj ) = |1011). We 

will denote in an analogous way by \ipij^'') (IV' ij^'')) ^ ^~ 
qubit pure state, in which ith and jth qubits are in the 
|1) (|0)) state and the remaining ones are in the |0) (|1)) 

state. Then by P^f^ and P[j^^ we denote projectors onto 

\i>if^) and Itpij^^), respectively. 

Let also Ti denote the partial transposition with re- 
spect to ith party (with the exception that Tq denotes the 
identity map). Here we usually assume that each party 
has two subsystems of a given state £Iaa' and sometimes 
Ti will be denoting the partial transposition with respect 
to one or both subsystems. It will be, however, clear 
from the context which of the subsystems are partially 
transposed. Concatenation of partial transpositions with 
respect to some subset of parties, say Ai, . . . , Ak will be 
denoted by Ti^. .^^. 



A. The first construction 

Here we assume that the key part on each site is 
of qubit structure, while the shield part has arbitrary 
dimension, however, with the same dimension on each 
site. More precisely, we have Hi — C'^ and Hi - 
ii = l,...,N). 



Now, let us introduce the following matrix 



X 



(N) 



1 



D 



N 



2D 



(N) 



(75) 

where, as previously, P^j^]^ denotes a projector onto the 
A^-partite D-dimensional GHZ state (see Eq. ^TU\i ). and 
Pj^'^ and Q^'* are projectors defined as 



(TV) 



R 



(N) 



D ~ -"-D 

where 



P 



(+) 



R 



(TV) 



R 



{N} 
D 



D~l 

i=0 



(76) 



(77) 



The projectors P^^^ and are chosen in such a way 

that each operator from the triple P^j^l;, -Pd^\ and 
is defined on orthogonal support. Furthermore, the de- 
nominator in Eq. (j75[) is chosen such that the matrix 

X^^ is normalized in the trace norm. 

The states under consideration are of the form 



{D,N) _ 1 

£'aa' ^ 



■ N 

i:(' 



(|o)(i 



®JV 



ID 



P] ' 



X 



{N)Ti 
D 



Ti 



X 



(N) 



A' 

(78) 



where the subscripts A and A' are indicated to distinguish 
their key and shield parts, respectively. However, for the 
sake of clarity, in further considerations these subscripts 
will be omitted. 

The normalization factor Af^"^ appearing in Eq. (I78p 
is given by 



(N + 1)D 



N 



2D 



D 



N 



2D -4 



(79) 



At the beginning we need to show that the matrices 

£'aa'^^ really represent quantum states, i.e., they are pos- 
itive (the normalization condition is already satisfied). 
Firstly, let us notice that the blocks corresponding to 
Po and Pq and the two off-diagonal blocks in Eq. ([78]) 
constitute a matrix of the form J\42{\x'^^\, X^^) (see 
Lemma A.l for the definition of Af^r), positivity of which 
is guaranteed by Lemma A.l. Thus the only thing we 
need to deal with is to show that the remaining blocks 

lying on the diagonal of f?AA'^'' positive. To achieve 
this goal, below we prove a more general lemma. 

Lemma V.l. Let xjf ^ be defined by Eq. Then 



the matrices \X 



D 



are positive semi-definite for all 



k.l = \,...,N. 

Proof. Noticing that -R^"* is diagonal for arbitrary 
D D and N, the partial transposition of xj^-* with re- 



spect to the fc-th subsystem may be written as Xf^ 
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[l/{D^ + 2D-4)]{s'j^^^''~R\^^), where S\^'^ is defined 



(AT) 



(80) 



As we will see below S 



1, 



, TV and S* 



(Ar)T,^(7V) 



D 



is positive for any k 



D 

lute value of X^^'^'' may be obtained by simple changing 



D 



0. Consequently, the abso- 



the sign before the projector R 



(AT) 



of S' 



To prove positivity 

/j^^^'' let \Tp) = J2n7-tiN "*i---iivNi ■ • - ^at) denote an 
arbitrary vector from (C^)"*^ written in the standard 
basis of (C^)®^. Then we have 



where T^j denotes the partial transposition with respect 
to two single subsystems A'j, and AJ. Now we can dis- 
tinguish two cases, namely, if fc = ^ and k ^ I. In the 
first one, double partial transpositions with respect to the 
same subsystem is just an identity map. Consequently 
from Eqs. dUD, dTT]), and ([SDD, one has 



X 



{N)Tk 
D 



D 



N 



2D 



DP. 



(+) 



D,N 



(83) 



(ii,...,ijv)e/fc 

>0. 



E 



(il,...,iiv)e/ 



\Oli 



2 .^1^ Qfj-.-i 



Here the notation ai,,,j,,,i means that all indices of as ex- 
cluding the fc-th one [k stands for the number of subsys- 
tem being partially transposed) are equal. Moreover, as 
previously / denotes the set of all sequences (ii, . . . , zat) 
except the cases when ii — . . . — iiq ^ while Ik is the set 
/ minus all sequences in which all indices but the one on 
/c-th position are equal. 

As the value of k is not specified, the above considera- 
tions holds for any k = I, . . . , N. Furthermore, using the 
same reasoning one can also prove positiveness of S*^"* 
being transposed with respect to any subset of different 
subsystems (besides the full transposition). This fact will 
be utilized below. 

By virtue of the positiveness of S'j^^'^'' we have that 



Now the right-hand side of Eq. ((83| is a linear com- 
|2bination of two positive operators and thus is positive. 
""' We have still left the second case, that is, when k ^ I. 
To resolve it we may use the remark made above, say- 
ing that the partial transposition of S'^^ with respect 
to arbitrary non only one-partite subsystem is a positive 
matrix. This ends the proof. | 

Thus we have just proven that P^^'^^ indeed represent 
quantum states. Now, our aim is to prove that on the 
one hand they are bound entangled and on the other 
hand they have nonzero distillable key. This purpose will 
be achieved in two steps. Firstly we show that partial 
transposition with respect to any elementary subsystem 

{AiA[) of g^A'^^ positive. Obviously, this does not 
confirm that the states are bound entangled since we do 
not even know they are entangled. However, the latter 
may be proven by showing that Kd of these states is 
nonzero for Z? > 3. 



k = 1 



{N)Tk I 



[l/(^^ + 2i?-4)](^}^ 



R 



D 



N . Therefore the partial transposition of the 
latter with respect to the Z~th subsystem gives 



X 



D 



1 



D 



N 



2D -4 



S 



D 



R 



{N) 



for any Firstly, we concentrate on the positivity of all partial 
ranspositions of g')^,^^ To gain a better look on the 
problem let us consider a particular example of such a 
partial transposition, namely, g^^f^^^'^'^ ■ From Eq. (j78p it 
(82) follows that 



X 



AD.3)T3 
fAA' 



<3) 



D 



(3) 
D 












X 



X 



X 



(3)T3 
D 






(3)T3 
D 






(3)T2 
D 









T2 ■ 



X 







(3)Ti 
D 








Tl.3 



X 








(3)Ti 
D 







X 









(3)T2 






X 



'^2,3 



X 



(3)T3 
D 






(3)T3 
D 

X 
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As, due to Lemma A.l, the square matrix consisting 
of two diagonal and two ofF-diagonal blocks of g\f^, 



(cf. Eq. dMl)) i.e., the matrix 7W2(|A:|f^^'|,X)^''^^'), is 
already positive, what we need to prove is positivity of 



iN)\T, 



and \X 



D 



for any k = 1, 



\X 

us therefore prove the following lemma. 



,iV. Let 



Lemma V.2. Let X\: ' be given by Eq. Then for 



any i,j,k— 1,...,N it holds that 



X 



(N) 



>o. 



X 



(N)Ti 



> 0. 



(85) 



Proof. Due to the definition of AT^-* its absolute value 

may be calculated simply by changing a sign before , 
giving 



Application of the recursive LOCC protocol presented 
in Section ITV CI to k copies of ^'AA'^^ gives with probabil- 
ity p^'^ = 2'="W^';]v/(A/'lf y the following state 



e 



(NM) 
AA' 



(fe) 



D,N 



■ TV 
.i=0 



11®^ + 11) 



X 



(N)Ti 
D 



Ti 



r(k) 

where A/^ is a normalization factor given by 

kl 



1 + iV 



D 



N 



(89) 



(90) 



X 



D 



N 



2D 



2P; 



D 



hD 2)PW + 2Pif ) + Q(f ) 

(86) 

Application of partial transposition with respect to the 
ith subsystem followed by substitution of Eq. ([76]) leads 
us to 



X 



(N) 
D 



Ti 



D 



N 



2D- A 



R 



(N) 



[D - 4)Pj 



i+m 

D,N 



(87) 

for any i = 1, . . . , A^. One may easily check that eigen- 



4)F^ AT ' always posi- 



values of jy ' belong to the interval [—1/D,1/D] and 
therefore the matrix l^,™ + {D - 

five. This, together with the fact that P)^"'' > 0, implies 

positivity of for any i — 1, . . . ,N. 

The second fact of the lemma may be proven just by 
noting that by virtue of Eq. ([5^ it holds 



X 



{N)Ti 
D 



1 



D^ + 2D-4 



S 



R 



(N) 



(88) 

As stated previously in the proof of Lemma V.l, the par- 
tial transposition of S*^' with respect to arbitrary sub- 
systems is positive. This concludes the proof. | 

The above lemma proves actually that all the par- 

{i — 1, . . . , N) are positive. 

are bound entangled, of 
course provided that they are entangled. This is because. 



tial transpositions g^/^,^^'^^ 
Therefore, the states Q^^/^^ 



due to the result of Ref. [ll|, positive partial transpo- 



sitions with respect to any elementary subsystem makes 
it impossible to distill fc-partite (fc = 2, . . . , TV) GHZ en- 
tanglement among any group of parties. 

Let us now pass to the proof that any state Q^^i^'^ for 
_D > 3 has nonzero Ku. For this purpose we show that 
using the protocol from Section IIV CI we can produce a 
state that is closer to some multipartite private state out 
of copies of ■ As we will show below we need to use 

as many copies as it is necessary to make the quantity 
appearing on the right-hand side of Eq. ([59)1 strictly 
positive. 



Now, to simplify the considerations we can utilize the pri- 
vacy squeezing (see Section IIVD|) to the obtained states 



e 



{N,k) 
AA' 



Namely, due to Lemma III.l there exist such 



twistings that after application to O^a''"'' ^.nd trac- 
ing out the A' subsystem one arrives at the following class 
of A^-qubit states 



ZiN.k) 



e 



(fe) 



D,N 



(|0)(1 



■ N 



(N) 



,i=0 



X 



X 

(N) 



{N)Ti 
D 

k 



Ti 



D 



(fe) 

In other words, after 'rotation' with and throwing 
out the A' subsystem we get a so-called privacy squeezed 
state, i.e., the one in which blocks are replaced with their 
norms. We also know from Theorem IV. 4 that the dis- 
tillable key of the cq state obtained from the privacy 
squeezed state O^^''^^ (measurement is performed in the 
same basis as twisting) cannot be greater than the dis- 

tiUable key of 

From Eq. ^ it follows that since Z?^ + 2D - 4 > 
for any _D > 3 one has A/'^'^^y ~^ 2, while for = 2, 
Af^'^l ^ 2iN + 1). In turn this means that for the off- 
diagonal elements of 0^^''"-' one has that 



(91) 



1 



X 



(N) 



1 



(92) 



with D > 3. By virtue of Theorem III. 3 one infers that 
the more copies of p^^)^^ we put into the recurrence pro- 
tocol, the closer we are to some multipartite private state. 
This also means that with k oo the sequence of states 



o(JV,fc) 
^A 



goes to GHZ state P2^, however, for D > 3 



Now, to bound from below the distillable key of 0^^''°-' 



^AA' 



according to the prescription given above we need to cal- 
culate a cq state of the privacy squeezed state 
(The cq state is found here with respect to the basis in 
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which the original state is defined.) Simple algebra gives 



o(cq) 



e 



1 



AE 



■'^D,N 

N 



Ri''>(^\Eo){Eo\ 



(JV) 



+ 2D-4 



\E,){E, 



(93) 



and \E, 



constitute a set of orthonormal 

(cq) 



where \Ef) 

states held by Eve. One notices immediately that O^""^ 
tends to the multipartite ideal cq state (see Eq. ([2])) for 
any integer I? > 3 whenever fc — > cx). 

To find a lower bound on distillable key of &\ ' we 
utilize Eq. ([68]) . However, according to Eq. (I68p one 
needs to calculate the quantities I{Ai '-Aj) for i ^ j and 

I{Ai : E) for the respective reductions of O^'^^^ Fortu- 
nately, the initial states Q^^r^^ have such symmetrical 
structure, preserved by the recurrence protocol and the 
privacy squeezing, that makes all the quantities I{Ai : Aj) 
(* 7^ j) equal (the same holds for I{Ai : E)). Conse- 
quently, in view of the above, using Eq. (j68|) and Theo- 
rem IV. 4 (see Eq. (j74p ). we infer the following inequality 




(b) 



1 50 



FIG. 1: An exemplary plot of R'dw = /(Ai ; A2)(e^'^^;\'^£;) 



Koief^^^) > I{Ai:A2)ie^^''J^E) - I{Ai:E){e^2^ZE) I{Ai: E){e^2l'il g) with iV = 3 (a) and for comparison in the 



,(ccq) 



'C>(ccq) 



(94) 

irrespectively of number of parties N. Exemplary be- 
haviour of the right-hand side of Eq. ([M)) (denoted by 
Kdw) in the function of k and D for = 3 is shown in 
Fig. [T]a,. It is clear from Figure [Iji that it is possible to 
distill one secure bit of key from bound entangled states 
©AA'*^^ for sufhciently large k. For comparison, Fig. [T]3 
contains a lower bound of the distillable key in the case 
of = 2 discussed in Ref. 15]. 

We can also investigate the lower bound on K]j for 
However, in this case we need 



the initial states fi'^A'^'' 



(k) 

to take into account the probability p\j j^- In this way 
we arrive at 



> Pd.n 



'l{A,:A,)ie^2:ti 

-/(Ai:i;)(e^"'^^ 



A1A2E/ 



(95) 



Figure [2^ presents exemplary behaviour of the function 
appearing on the right-hand side of Eq. ([M]) (denoted 
by Kdw) for A'^ = 3. For comparison, in Figure [2b it is 
also plotted the same function in the case of = 2 (this 
case was discussed in Ref. [27]). 

Let us conclude the first construction with discussion 
of some of its general properties. Above we used a 
particular class of matrices X}f ^ (defined in Eq. (75)), 
however, it seems interesting to ask wether there are 
other matrices than X^j^^ that could be used in the con- 
struction. In what follows we provide some constraints 



' ^--^ ■ ~ ' \ - JilJiol^/ _ ^^.^ 

case of A/' = 2 (b), which was discussed in Ref. j27j]. For the 
sake of clarity, zero is put whenever the plotted function is less 
than zero. Notice also that even though k and D are discrete 
parameters, the graph is made as if Kdw were a function of 
continuous parameters. It follows from both the figures that 
the number of parties A'^ significantly influences the obtained 
lower bound. Namely, for A'' = 3 one needs to spend more 
copies of a given state to get nonzero values of Kdw- 



must obey to be useful for purposes of the construction. 
The first important condition is that the trace norm 
of z'^j^^ has to be strictly larger than the trace norm 

I (N)T- I Ti 

of \Zjj '] for all i = 1,...,N. This guarantees 
convergence (in the trace norm) of the output states 
of the recursive LOCC protocol (given in Sec. IV. C) 
to some multipartite private states. Another crucial 
conditions are ' > and ' > for all 



1, 



, A^. The first one is necessary for g]^/^^ (when 



constructed with the matrix Z^j^^) to be positive, while 

the second one allows to prove that g^/^i^^ have positive 
partial transposition with respect to any elementary 
subsystem. 



Lemma V.3. 
acting on (C^)' 



Assume that z')^'^ is arbitrary matrix 
'-^ and that the following conditions 



that the general matrix, hereafter denoted by Zj^ 



(N) 



(i) 



Z 



(N) 



> 



z 



{N)Ti 
D 



for alH = 1 , . 
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(iii) Finally, assume that > and that there exists 



such k that Z 



D 



> 0. Then 



7(7V)Tfc|Tfc 



This contradicts the first assumption. 



This lemma says that a matrix can be used in the above 
construction if it is not positive and all its elementary 
partial transpositions are not positive. Thus, in particu- 
lar, a general density matrix is not suitable for this con- 
struction. 
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16 



2 4 



(b) 



FIG. 2: An exemplary plot of Kdw = 

b; ~ • j^A^AiAaB-'J with A'' = 3. 
For comparison it is also presented the case of A'' = 2 (b). For 
the sake of clarity, zero is put whenever the plotted function 
is less or equal to zero. Also, though both the parameters 
k and D are integer, for convenience, the function Kdw is 
plotted as if it were a function of continuous k and D. It is 
clear that for A = 3 the lower bound on distillable key is 
considerably smaller. 



(ii) 
(iii) 



Ti 



> for aU i = 1, 



> for all 1 = 1,, 



are satisfied. Then ^ and Z\^' ^ for aU 

1 = 1,. ..,N. 

Proof, {ad ahsurdum) We divide the proof into three 
parts: 

(i) Assume that Z^^^ > and ^ for any 



= 1, 



(7V)|T, 



. . ,N. Then one can see that 

^ for any choice of i. However, this con- 
tradicts the third assumption. 

(ii) Assume that Z^"* ^ and there exists such k 



that Z 

7{N) 



D 



> 0. Now, one obtains \Zjj 



(JV)Tfc|Tfc 



^ 0. Of course, this is in contradiction to the 



second assumption. 



B. The second construction 

The crucial ideas behind the second construction are 
actually the same as in the case of the first one, however, 
considerations will be a little bit more sophisticated. 



Let us first define the analog of 
construction to be 



(N) 



D~l 



(8)Af 



from the first 



(96) 



i,J=0 



where we assume that 



are elements of some D x D 



general unitary or unitary Hermitian matrix, hereafter 
denoted by Ud- Thus ^ is an embedding of Ud G 
Af£i(C) (Af£i(C) denotes the set oi D x D matrices with 
complex entries) in M^n (C) and therefore 



X 



(N) 



R 



(N) 
D ■ 



(97) 



For further simplicity we also impose the condition that 
— for i, j = 0, . . . , D — 1, however whenever 

possible all proofs will be given assuming that C/d is a 
general unitary matrix. 

It should be also pointed out that the distinction on 
unitary or unitary and Hermitian matrices Uu made 
above plays an important role here. This comes from 
the LOGO protocol presented in Section IIVCI as in the 
case of unitary but not Hermitian matrices it needs to be 
slightly modified. Namely, in its last step all the parties 
keep the state only if all zeros occurred. 

A particular example of a unitary but in general not 
Hermitian matrix satisfying the above condition is the 
matrix Vd = {1/\/D)Vd, where Vd denotes the Vander- 
monde matrix of solutions to the equation — 1 = 
with z £ <C. As one knows the solutions are of the form 
LUf. = Q-^^ik/D (fc = 0, . . . , Z) - 1). It is then clear that 

Vd is a unitary matrix for any D > 2, however not al- 
ways a Hermitian one. For instance, in the particular 
case of D = 2 one easily recognizes that V2 is the known 
Hadamard matrix. A good example of some unitary and 
Hermitian matrix is fcth tensor power of V2. Since V2 
is unitary and Hermitian any matrix of the form V.f''^ is 
also unitary and Hermitian. 
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Now, let us consider following family of matrices 

N N 



£'aa' ^ 



+ |0)(1 



3=0 



N 



(AT) 
DA 



i=l 

N 



(98) 



that \uij\ = 1/v-D, the normalization factor becomes 

A/'lf ^ = 2ND{1 + nVD). 

As in the case of the first construction, we need to 

prove that p^^'^'' represent quantum states. Moreover, 
we show also that they have positive partial transposi- 
tions with respect to any elementary subsystem. From 
Eq. ([98| it follows that to prove positivity of ^^'^^ 
has to show that the inequalities 



where A/'n^'' stands for the normalization factor, which 



/D 

for arbitrary unitary Ud is given by 

D-l 



N 

E 



X 



(N) 
D.i 



N 



< 



EK 



(N) 
DA 



(100) 



(99) 



Obviously for xj^'' that comes from unitary Hermitian 
Ud the conjugation in the last term in Eq. ([55)1 may be 
omitted. Moreover, taking into account the assumption 



J 



are satisfied. Then simply utilizing Lemma A.l and not- 
ing that the remaining blocks lying on the diagonal of 
g^j^'/^^ are positive by definition, the positivity of g'}^,^^ 
is proved. 

To deal with the problem of positivity of partial trans- 
positions let us look on the particular example of form of 
g}^/^^^'^''- From Eq. ^ one infers that 



~{£>,3)T3 



(3) 



El^ 



(3)T3 



j:x 



(3)T3 
DA 



E|n^ 

i-- 





(3)T2 



E^'n 



(3)T3t 



E^sri 

1=1 

3 



Y^l^S^' 
El^ 



H3)T2 
^DA 



(3) 
DA 



(101) 



where we used the fact that | A^j^-^'' | are diagonal in the the following equalities holds 
standard basis and therefore are not affected by partial 
transposition with respect to any subsystems. 

To show positivity of g^^'^'' as its partial trans- 

positions we prove the following lemma. 



N 



IK 



(N)T, 



N 



-EK 



{N)T, 
DA 



(j =0,...,7V). (102) 



_ Proof. Firstly we start by the above statement for j = 0. 

Lemma V.4- Let be defined as in Eq. Then For this purpose let us notice that its left-hand side may 
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be written as 



N 

E 



X 



(N) 
D.i 



N 



D-l 

E 

k=0 



N D-1 



i=l k,l=0 



(103) 

Straightforward algebra shows that both terms under the 
sign of absolute value are defined on orthogonal sup- 
ports. Moreover, all the partial transpositions in the 
second term are defined on orthogonal supports. Both 
these facts allow us to write 



N 



E^- 



D,i 



i=l 



D-1 



(104) 

One finds immediately that this equals the right-hand 
side of (|102p , finishing the first part of the proof. 

To show Eq. p02p for j = 1, . . . , we need to perform 
a little bit more sophisticated analysis. With the same 
reasoning as in the case of the first inequality we can 
reduce the claimed inequalities to the following 



X)^^ + {N-l)Y,Ukk\k){kf 



k=0 
D-1 



< R 



(AT) 



-{N -l)Y,\ukk\\k){k\ 



®N 



k=0 



where we utilized Eq. ([97)1 . One notices that the above 
inequality may be further reduced to 



\Ud + (iV - 1)V\ <1d + {N -l)\V\ 



(106) 



where T) denotes a diagonal matrix containing the diago- 
nal elements oHJd- Utilizing the fact that \uij \ — 1/a/D 
for any i, j = 0, . . . , D — 1, we infer that \V\ = (1/-\/D)1d 
and therefore 



(107) 



\U+{N - 1)V\ < [1 + {N -l)/^/D]l 



To prove this inequality we can utilize the polar decom- 
position to its left-hand side. More precisely we can write 
\U +{N - l)V\ = V'^U +{N - l)V^V with V denoting 
some unitary matrix. This allows us to write 

(^-l \U + {N -l)V\ I*) = |(*| \U +{N -l)V\ |*)| 

< |(*|T/^C/|*)| 
-|-(A^- 1) |(*|V"^X>|^')| 

< 1 + (A^- 1) |(^'|1/^|X>|W^|^')| 
A^- 1 



< 1 



D 



(108) 



where \^) is an arbitrary normalized vector from C^. 
The second and third inequality are consequences of the 
fact that the product of unitary matrices is a unitary 
matrix and that for any normalized and unitary U 



it holds that |(V'|C/|'0)| < 1. Moreover, we put here the 
polar decomposition of 2?, i.e., V — \'D\W with some uni- 
tary W . The last inequality is also a result of application 
of aforementioned fact that \'D\ — {\/ y/D)!^. 

Now, to finish the proof, it suffices to mention that the 
resulting inequality is equivalent to (|107p . | 

From the above lemma it clearly follows that g^^'^^ 
represent quantum states for any D >2 and N >2, and 
they have positive partial transpositions with respect to 
all elementary subsystems. The last thing we need to 

prove is that the distillable key of ^^J^'' is nonzero. This 
would also imply that Q^j^'r''^^ represent entangled states. 

Let us then apply the recursive protocol described pre- 
viously in Section flV CI to k copies of g'}^,^\ obtaining 



p,iN,k) _ 



AA' 




(109) 



(105) with the normalization factor given by 



ND^JD 



2ND'' 



1 + {N -l)^D 



(110) 

Notice that as previously mentioned, the LOCC proto- 
col should be modified in case when xj^^ follows from 
in general unitary Ud- Due to the modification of the 
LOCC protocol, the probability of obtaining 9 
the case of unitary and unitary Hermitian Ud is differ- 
ent. Namely, in the case of unitary Hermitian matrices 
amounts to 



(NM) 
AA' 



~<fc,l) 

Pd,n 



2^-iA/-W^/(A/-W ) 



(111) 



while in the case of unitary non Hermitian the probability 
of success is considerably smaller and is given by 



Pd.n 



(112) 



Now the multipartite privacy squeezing (see Section 
II VP I) allows us to change blocks in Eq. (|109p with their 
norms, obtaining 



giN.k) _ i 

A .7(fc) 
D.N 



TV 



(N) 



N 



(N)T, 



|1>(0| 



N 



(TV) 



i=l 



(113) 
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Calculating the respective norms in the above, one may 
rewrite Eq. (|113p as 



^{N,k) _ D 

■^^ D,N 



3 = 1 



(114) 




From Eqs. (jllOj) and (|114p one easily infers that o')^''^^ — > 

^2~iV for fc ^ oo for any D >2, which by virtue of Theo- 
rem III. 3 means that the recursive protocol when applied 

to copies of 'g'/^'i^^ produces a state that is arbitrarily 
close to some multipartite pdit in the limit of fc ^ oo. 

In fact, as the probabilities of success p^'j^' and p^^'^ 
(see Eqs. (jllip and (|112p ) are positive, according to the 
definition of Ku (see Definition IV. 1) the above method 

leads to distillation of secure key from g^/^'i^^ ■ Below we 

provide also plots of lower bounds on Kd of ej^^;^^ 

For this purpose we can find the purification of g^/^'i^^ 
and then the cq state in the standard basis. The latter 
has the form 



i:(' 



^(fc) 

-'d,n 



' 3 



\E,){E,\\,{llb) 



where \Eo), \Ej), and \Ej) (j = 1, . . . , iV) are orthonor 

mal states kept by Eve, and coefficients a'^'^ 
are given by 



D,N ^'id 6^^^ 



(fc) _ 
'''D.N ~ 



{NDVD 

■^^ D,N 



(116) 



FIG. 3: The function appearing on the right-hand side of 
Eq. pi8[l (denoted here by Kdw) in the function of number 
of copies k and the dimension D. Zero is put whenever the 
function is less than zero. Notice that both the parameters 
k and D are discrete, however, continuous plot is made to 
indicate better the behavior of Kdw- It is clear from the plot 
that for larger k the distillable key of O^/^'^^ approaches one 
bit (this is actually a maximal value obtainable from two- 
qubit states) and the convergence depends on D. Namely, for 
higher dimensions D the convergence to the maximal value is 
faster. 



We can also get a lower bound on distillable key of 
Here we need to take into ac- 



the initial states g^/^'^^ 



count the probability of success (p^'^^ andp^'^) in the 
recursive protocol. 

The corresponding bounds on the distillable keys of 

fe^AA' 



are 



-I{A,:E){QfXE) 



(119) 



and 



Exemplary plots of the right-hand side of the above (de- 
noted by K^'j^^^) both in the case of a unitary Hermitian 

matrix (e.g. V^^) and only a unitary matrix (e.g. Vd) 
are given in Figure and|4|3. 



(fe) 



-[1 + (TV - 1)VZ3]' 



D,N 



(117) VI. REMARKS ON LIMITATIONS IN 

MULTIPARTITE QUANTUM CRYPTOGRAPHY 



One can see from the above that the limit of fc — > oo 
leads us to the ideal cq state. Now we can apply the 
bound given in Eq. ([M)) . It is easy to verify that all the 
quantities I{Ai : Aj) are equal here (the same holds for 
I{Ai :E)) and therefore we can rewrite Eq. as 



>I{A,:A,){e^rlE) 



I{Ai 



(118) 

Exemplary plot of the function appearing on the right- 
hand side of Eq. (|118p (denoted as Kdw) is presented 
in Figure [21 The behavior of Kdw (see Fig. [3]) confirms 
the previous analysis, namely, the more copies we spend 
the closer the state is to some multipartite private state 
we obtain using the recursive protocol. Thus the higher 
key rate we can get from the obtained state oj^^;'"^- 



So far, we discussed the general scheme allowing for 
distilling secure key from multipartite states. It is desir- 
able however to discuss also what are the limitations of 
multipartite secure key distillation. 

An interesting effect, which we shall recall here, was 
reported in Ref. [Ill, namely, it was shown that though 
maximal violation of some Bell inequality it is impossible 
to distill secure key from the so-called Smolin state [sj : 



(120) 



where |V'f ) (i = 0, . . . , 3) are the so-called Bell states 



?iven by 



(1)/ 



(1/V2) (|0I)±|10)) and Hj^^,^) 
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FIG. 4: Lower bounds on Kd of in the function of k 

and D. The upper plot (a) presents lower bound (denoted 
here by K^]^\^) on Kd in the case of unitary Hermitian ma- 

— ('2) 

trices Ud, while in the second plot (b) lower bound {K]j{^) 
in the case of unitary but not Hermitian matrices is given. 
Both are just a product of probability p^'j^ (left) or p^'^' 
(right) and Kdw plotted in Figure [3] One infers that in the 
case of unitary but not Hermitian matrix Ud the region of 
nonzero values of the plotted function is wider than in the 
case of unitary Hermitian matrices. 

(1/V2) (|00) ± |11)). This conclusion may be also in- 
ferred for the generalizations of the Smolin state provided 
in Ref. [s^ and independently in Ref. [S^] (see also Ref. 

for further generalizations). These are states of the 
form 

m=0 
m=0 



02{n+l) - 4 ^2n Q2nU2n U2 Q2U 2 

m— 

(121) 

with C/f^'"^ = if^-'^^ ® cr™ (m = 0, . . . , 3 and fc = 2, . . .), 
where Um {m = 1,2,3) denote the usual Pauli matrices 
and ao — l2- The state g2 is just one of the Bell states, 
while gf is the Smolin state. All states g2n for n > 
2 are bound entangled and for suitable choice of local 



observables all states for n > 1 violate the Bell inequality 

l-E-l...!! + -B1...12 + £-2. ..21 — £'2...22| < 2 (122) 

maximally {E denotes the so-called correlation function, 
i.e., an average of products of local measurement out- 
comes taken over many runs of experimerit) . On the 
other hand, due to the results of Refs. [1, Q, and Ref. 
[30| . one may show that it is impossible to distill multi- 
partite secure key from states pfn for n > 2. This shows 
that bipartite Ekert protocol [2] cannot be straightfor- 
wardly generalized to multipartite scenario since as dis- 
cussed above the maximal violation of most natural mul- 
tipartite analog of the CHSH-Bell inequality [38] does 
not imply nonzero secret key rate, whereas maximal vio- 
lation of CHSH-Bell inequality by two qubits guarantees 
secrecy. Still, it would be an interesting problem for fur- 
ther research to identify all Bell inequalities that do the 
job in multipartite case as CHSH-Bell inequality does in 
the case of two qubits. It should be stressed that some 
achievements in a similar direction were already obtained 
in Refs. [1^ \^ , where it was shown that violation of 
some Bell inequalities is sufficient condition for security 
of multipartite secret sharing protocols [4l[ under an in- 
dividual attack of some external party. 

VII. CONCLUSIONS 

Quantum cryptography beyond entanglement distilla- 
tion is a very young subject. Until recent times it was 
natural to expect that the latter is impossible. While 
there were significant developments concerning the bipar- 
tite scenario the general formulation for multipartite case 
was missing. The present paper fills this gap by not only 
generalizing the scheme, but also by providing new con- 
structions of multipartite bound entangled states which 
is really nontrivial. However, there are many unsolved 
questions. First it seems to be true that the uncondi- 
tional security proof [22] can be extended here at a cost of 
the number of estimated local observables, but an exact 
analysis of this issue is needed. Moreover, given a fixed 
number of parties, it is not known what is the minimal 
dimension of elementary system of PPT like bound en- 
tangled state that allows one-way secure key distillation. 
Does it increase with number of particles and if so - how 
the dependence looks like? Are there bound entangled 
states with multipartite cryptographic key with underly- 
ing structure corresponding to other classes of pure states 
like graph states (see Ref. 5^)? One may ask why we 
have considered only bound entanglement in multipartite 
scenario. This is when it is necessary to apply the gener- 
alized scheme. Otherwise qualitatively (though may be 
not quantitatively - see subsequent discussion) just pure 
entanglement distillation is a sufficient tool. Quite natu- 
ral is a question of interplay between the two approaches 
in distilling key - to what extent can we abandon distil- 
lation of p-dits? Finally, can the two processes always be 
separated in optimal key distillation scheme: in a sense 
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that one gets some number of singlet states and some 
large p-dit which is bound entangled)? If it were so, the 
two parts might serve as a natural measures of free and 
bound entanglement in the system. Most likely this is 
impossible, but one needs a proof. The closely related 
question is the one concerning lockability of the secure 
key Ku (note that nonadditivity of Ko has been proved 
very recently in Ref. [i^). While this seems to be a very 
hard question in case of bipartite states (though lockabil- 
ity with respect to Eve has already been ruled out in Ref. 
[l9|) it may happen to be easier within the multipartite 
paradigm presented here (in analogy to classical bound 
information which is known only in asymptotic bipar- 
tite form [i^l but naturally emerges form bound entan- 
glement in multipartite case [i^. In this context novel 
upper and lower bounds on are needed (for recent 
development see Ref. 5^). This point is also interest- 
ing from the point of view of entanglement as Kd is also 
an entanglement measure. Further analysis of Kjj and 
finding its multi-coordinate extensions to help in charac- 
terization of multipartite entanglement seems to be rich 
program for future research. 

Also, though in the present paper we are concerned 
with a general problem of two-way distillabillity of secure 
key, it is interesting to discuss the problem in the context 
of one-way schemes. For instance one could ask about 
bounds on key within such schemes (see e.g. Ref. [25j). 
On the other hand, it would be desirable to discuss the 
present approach in the context of secure key distillation 
from continuous variables systems (see e.g. Refs. [47l.l48l. 
[igj). For instance, it was shown in Ref. [s^l that the 
generalized version of the protocol from Ref. [i^] does 
not allow for secure key distillation from bound entangled 
states. It seems that within the multipartite scenario the 
problem could be simpler a little as one can have bound 
entangled multipartite states with some of its partitions 
being still NPT. 



APPENDIX A: SOME USEFUL LEMMAS 

Lemma A.l. Assume that a given d x d matrix B is 
normal. If ^ > \B\ then the matrices 



MNiA,B) 



and 



{N-l)A B 

{N~l)A 



St 



5t 



B 
B 

{N-1)A 

(Al) 



Mn{A,B) 



{N- l)A B B 
B^ AO 
OA 







B 



A 



(A2) 



are positive. 

Proof. We prove the lemma only for Ai]^{A, B) as the 
proof for Mn{A, B) goes along the same lines. 

The matrix Mn{A,B) consists of N'^ blocks d x d 
each and consequently the whole matrix has the di- 
mensions Nd X Nd. Thus to prove positiveness we 
need to show that for any \'^) € C''^'^ the inequality 
{9\MNiA, 5)1*) > holds. It is clear that an arbitrary 
vector l^f) e C^"^ may be written as 



I*) = 



\xn) 



(A3) 



where each \xi) belongs to C*. Then a rather straight- 
forward algebra leads to 



N 



{^\Mn{A,B)\^) - (iV - 1) 



Needless to say due to Choi-Jamiolkowski isomor- 
phism [5lj the present analysis provides new classes of 
multiparty quantum channels for which natural questions 
on superactivation of the type found in bipartite case (20| 
and other possible effects of similar type arise. 



N 



+2 Re{x^\B\xj). (A4) 



i<j 



By virtue of the assumption that A > \B\ and the in- 
equality Rez > — |z| satisfied for any z e C, one has 



N 



{^\MNiA,B)\<f)>{N~l)Y,{x^\\B\\x^ 



N 
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-2^ (A5) 



i<j 

Since B is assumed to be a normal matrix it may be given 
as i? = I]fc •^fcl'/^fcXVfcl 'witl^ {^k} being, in general, the 
complex eigenvalues of B, while {If^Sfc)} its orthonormal 
eigenvectors. Putting the spectral decomposition of B 
into Eq. (IA5p . introducing aik = \{xi\ipk)\ > 0, and 
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taking into account the fact that — Si ICiL 

obtain 



^ N N ^ 

V ^<3 I 

(A6) 

It is clear from Eq. (jA6p that to show nonnegativity of 
(^'|7WAr(^,B)|^') for any l^-) G C^'^, one has to prove 
that for all k the term in brackets in Eq. (|A6p is nonneg- 
ative. This, however, follows from the fact that 



, which together with the assumption that Cq and Cq 

are close to Xjd and e < l/d, implies that must obey 

> 1/ d— 3e for any = 1, . . . , c?— 1. Taking into account 

the assumption that TrA < 1, one also has that each 

must be bounded from above as < 1/d + 3(d — l)e for 
j — — 1. Therefore, we have that all diagonal 

elements of A satisfy 



^ d 



(A9) 



N 



(A7) 



finishing the proof. 



be a positive 



Lemma A. 2. Let A 
matrix obeying TtA < 1. Assume that each element of 
A lying in ith row (and ith column due to hermiticity of 
A) is close to l/d in the sense that it obeys — < e 
for some 1/d > e > 0. Then — < 77(e) for any 
I, J = 0, . . . , d — 1, where r]{e) ^ for e ^ 0. 

Proof. The proof is rather technical and we present 
only its sketch here (detailed proof may be found in Ref. 
[26l|). First, let us fix the chosen row to be the first one, 
i.e., i = 0. Then, from the positivity of A it follows that 
any matrix of the form 



"0 



(A8) 



is positive. Now, from its positivity we have that a^a-j 



> 



with a(e) for e ^ 0. Now, we need to prove that 
the remaining off-diagonal elements of A are also close 
to 1 /d. For this purpose let us notice that from the fact 
that A> one has that the following matrices 



a,- a: 



{0<i< j) 



(AlO) 



^ ^ ^ »j _ 

are also positive. Since we can now say that all elements 

in the first row (and column) and all the diagonal ele- 
ments obey (IA9[) . it follows, after some technical calcula- 
tions, that al has to satisfy such inequality, however, with 
some other function which vanishes for e — s- 0. Finally, 
we have that any of the elements of A satisfies 



< 77(e) (z,j-0,...,rf-l) 



(All) 



with 77(e) —t whenever e — > 0. 

Of course, we can always assume that the elements in 
some fixed row of A is bounded by different es. Then, 
however, we can take the largest one. | 
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